How to Check MFA Status for Users in Microsoft Entra ID

# Install (run once, elevated)
Install-Module Microsoft.Graph -Repository PSGallery -Force

# Import for this session
Import-Module Microsoft.Graph.Authentication
Import-Module Microsoft.Graph.Users
Import-Module Microsoft.Graph.Reports

# Connect with read scopes
Connect-MgGraph -Scopes "User.Read.All", "UserAuthenticationMethod.Read.All", "AuditLog.Read.All"

# Confirm the session
Get-MgContext

# All methods for one user
Get-MgUserAuthenticationMethod -UserId "user@yourdomain.com"

# Only phone methods
Get-MgUserAuthenticationMethod -UserId "user@yourdomain.com" |
  Where-Object {$_.AdditionalProperties["@odata.type"] -eq "#microsoft.graph.phoneAuthenticationMethod"}

# Only Microsoft Authenticator app registrations
Get-MgUserAuthenticationMethod -UserId "user@yourdomain.com" |
  Where-Object {$_.AdditionalProperties["@odata.type"] -eq "#microsoft.graph.microsoftAuthenticatorAuthenticationMethod"}

# Inspect the full structure
$userMethods = Get-MgUserAuthenticationMethod -UserId "user@yourdomain.com"
$userMethods | Format-List *

# Get-MFAStatus.ps1
param(
  [string]$ExportPath = "C:\Reports\MFA-Status-Report-$(Get-Date -Format 'yyyy-MM-dd-HHmm').csv"
)

Import-Module Microsoft.Graph.Authentication
Import-Module Microsoft.Graph.Users
Import-Module Microsoft.Graph.Reports

Connect-MgGraph -Scopes "User.Read.All", "UserAuthenticationMethod.Read.All", "AuditLog.Read.All"

$results = @()
$users = Get-MgUser -All -Property DisplayName,UserPrincipalName,Id,AccountEnabled,CreatedDateTime
Write-Host "Processing $($users.Count) users..." -ForegroundColor Yellow

foreach ($user in $users) {
  Write-Progress -Activity "Processing Users" -Status "Checking $($user.DisplayName)" -PercentComplete (($results.Count / $users.Count) * 100)
  try {
    $authMethods = Get-MgUserAuthenticationMethod -UserId $user.Id -ErrorAction SilentlyContinue
    $mfaCapable = $false; $registeredMethods = @(); $defaultMethod = "None"; $strongMethods = 0
    foreach ($method in $authMethods) {
      switch ($method.AdditionalProperties["@odata.type"]) {
        "#microsoft.graph.microsoftAuthenticatorAuthenticationMethod" { $registeredMethods += "Microsoft Authenticator"; $mfaCapable = $true; $strongMethods++ }
        "#microsoft.graph.phoneAuthenticationMethod"                   { $registeredMethods += "Phone"; $mfaCapable = $true; $strongMethods++ }
        "#microsoft.graph.emailAuthenticationMethod"                   { $registeredMethods += "Email" }
        "#microsoft.graph.fido2AuthenticationMethod"                   { $registeredMethods += "FIDO2 Security Key"; $mfaCapable = $true; $strongMethods++ }
        "#microsoft.graph.softwareOathAuthenticationMethod"            { $registeredMethods += "Software OATH Token"; $mfaCapable = $true; $strongMethods++ }
        "#microsoft.graph.windowsHelloForBusinessAuthenticationMethod" { $registeredMethods += "Windows Hello for Business"; $mfaCapable = $true; $strongMethods++ }
      }
    }
    if ($registeredMethods -contains "Microsoft Authenticator") { $defaultMethod = "Microsoft Authenticator" }
    elseif ($registeredMethods -contains "FIDO2 Security Key")   { $defaultMethod = "FIDO2 Security Key" }
    elseif ($registeredMethods -contains "Phone")                { $defaultMethod = "Phone" }
    $results += [PSCustomObject]@{
      DisplayName=$user.DisplayName; UserPrincipalName=$user.UserPrincipalName; AccountEnabled=$user.AccountEnabled
      MFACapable=$mfaCapable; StrongMethodCount=$strongMethods; DefaultMFAMethod=$defaultMethod
      RegisteredMethods=($registeredMethods -join "; "); MethodCount=$registeredMethods.Count
      UserCreated=$user.CreatedDateTime; ProcessedDate=(Get-Date -Format "yyyy-MM-dd HH:mm:ss")
    }
  } catch { Write-Warning "Failed to process $($user.DisplayName): $($_.Exception.Message)" }
}

$exportDir = Split-Path $ExportPath -Parent
if (!(Test-Path $exportDir)) { New-Item -ItemType Directory -Path $exportDir -Force | Out-Null }
$results | Export-Csv -Path $ExportPath -NoTypeInformation -Encoding UTF8
Write-Host "MFA capable: $(($results | Where-Object {$_.MFACapable -eq $true}).Count) / $($results.Count)" -ForegroundColor Green
Disconnect-MgGraph

# Run it:
# .\Get-MFAStatus.ps1 -ExportPath "C:\Reports\MFA-Report.csv"

$mfaReport = Import-Csv -Path "C:\Reports\MFA-Report.csv"

# Active users without MFA capability
$nonMFAUsers = $mfaReport | Where-Object {$_.MFACapable -eq "False" -and $_.AccountEnabled -eq "True"}
$nonMFAUsers | Select-Object DisplayName, UserPrincipalName, RegisteredMethods | Format-Table -AutoSize

# Users with only email registered
$emailOnlyUsers = $mfaReport | Where-Object {$_.RegisteredMethods -eq "Email" -and $_.AccountEnabled -eq "True"}
$emailOnlyUsers | Select-Object DisplayName, UserPrincipalName | Format-Table -AutoSize

# Compliance percentage across active users
$totalActiveUsers = ($mfaReport | Where-Object {$_.AccountEnabled -eq "True"}).Count
$mfaCapableUsers  = ($mfaReport | Where-Object {$_.MFACapable -eq "True" -and $_.AccountEnabled -eq "True"}).Count
$compliancePercentage = [math]::Round(($mfaCapableUsers / $totalActiveUsers) * 100, 2)
Write-Host "Compliance rate: $compliancePercentage% ($mfaCapableUsers / $totalActiveUsers active users)"

# Priority action list
$priorityUsers = $mfaReport | Where-Object {
  $_.AccountEnabled -eq "True" -and ($_.MFACapable -eq "False" -or $_.RegisteredMethods -eq "Email")
} | Select-Object DisplayName, UserPrincipalName, RegisteredMethods, UserCreated
$priorityUsers | Export-Csv -Path "C:\Reports\MFA-Priority-Actions.csv" -NoTypeInformation